SSHD服务搭建

SSH协议：安全外壳协议。为Secure Shell 缩写。SSH为建立在应用层和传输层基础上的安全协议。

 

1、检查SSH服务端安装情况

1. [root@rhel6_84 ~]# rpm -qpi /mnt/Packages/openssh-server-5.3p1-94.el6.x86_64.rpm #rpm -qpi packetname 查看安装包的内容

2. ~]# rpm -qa |grep openssh #检查ssh安装情况。如果没有使用rpm安装一遍。
3. openssh-5.3p1-94.el6.x86_64
4. openssh-clients-5.3p1-94.el6.x86_64
5. openssh-askpass-5.3p1-94.el6.x86_64
6. openssh-server-5.3p1-94.el6.x86_64

 

2、启动SSHD服务

1. [root@rhel-6 ~]# service sshd start
2. [root@rhel-6 ~]# /etc/init.d/sshd start #绝对路径方式启动
3. [root@rhel-6 ~]# chkconfig sshd on #设置sshd服务开机自启 on自启 off关闭自启
   [root@rhel-6 ~]# chkconfig --list sshd #检查开机自启情况
   sshd 0:关闭 1:关闭 2:启用 3:启用 4:启用 5:启用 6:关闭

 

3、客户端保存的密钥

1. [~]# cat .ssh/known_hosts #查看本机保存的服务端的密钥。
2. 192.168.3.81 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDCzit8dq4s0xZCk1Gme5GJfYaWZzYHW37KHMfpaU7Fc2/npmJpHpufXGiYR+h9bAR6DBJvDzp5Mr/nmoaOxLb9WH4dsD9ZyLVTLzp3gaFpk9Fc7B8VRznIgveRYmIue146DoU3+Hjt7DWA19Cg4vxGZih/RekhmUgwEbKmxoC1KW6Qm6Aqd+F5oNIdign8KtFaIMzE4cNcL6YEb1wdYTk3fdUWhUip0Fir3sej9zjrGdCCA3HPxuPbsPE+3yaQ975yfelKRHI/DUpsKegQHK88RtfElLnDOVgle/yne8vsvDgnB1JYKZTGu8XuHG+vGwQAR+E2AelQcQDVFZ0+eJ+T

 

4、SSHD服务配置文件

1. [root@rhel6_84 ~]# cp /etc/ssh/sshd_config{,.back} #修改前备份此配置文件

2. [root@rhel6_84 ~]# ls /etc/ssh/
moduli ssh_config sshd_config sshd_config.back ssh_host_dsa_key

3. [root@rhel6_84 ~]# cat -n /etc/ssh/sshd_config
4. #Port 22 #端口，默认是22，最好修改为其它

5. [root@rhel6_84 ~]# netstat -anptu |grep ssh #修改好后，查看ssh服务是否正常监听新端口（222）
tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN 2597/sshd
tcp 0 0 0.0.0.0: 0.0.0.0:* LISTEN 2765/sshd
tcp 0 52 192.168.3.84:22 192.168.3.130:57537 ESTABLISHED 2597/sshd
tcp 0 0 ::1:6010 :::* LISTEN 2597/sshd
tcp 0 0 :::222 :::* LISTEN 2765/sshd


 

5、新端口ssh连接

1. root@192.168.3.84 #加上-p参数 指定222端口 连接新服务器

 

6、SSHD配置文件详解

1. # $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $
2. # This is the sshd server system-wide configuration file. See
3. # sshd_config(5) for more information.
4. # This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin #ssh所执行的bash目录
5. # The strategy used for options in the default sshd_config shipped with
6. # OpenSSH is to specify options with their default value where
7. # possible, but leave them commented. Uncommented options change a
8. # default value.
9. Port222 #ssh服务端口号
10. #AddressFamily any
11. #ListenAddress 0.0.0.0
12. #ListenAddress ::
13. # Disable legacy (protocol version 1) support in the server for new
14. # installations. In future the default will change to require explicit
15. # activation of protocol 1
17. # HostKey for protocol version 1
18. #HostKey /etc/ssh/ssh_host_key
19. # HostKeys for protocol version 2
20. #HostKey /etc/ssh/ssh_host_rsa_key
21. #HostKey /etc/ssh/ssh_host_dsa_key
22. # default value.
24. #AddressFamily any
25. #ListenAddress 0.0.0.0
26. #ListenAddress :: #指定只监听的IP地址，设置只允许此IP登陆
27. # Disable legacy (protocol version 1) support in the server for new
28. # installations. In future the default will change to require explicit
29. # activation of protocol 1
31. # HostKey for protocol version 1
32. #HostKey /etc/ssh/ssh_host_key
33. # HostKeys for protocol version 2
34. #HostKey /etc/ssh/ssh_host_rsa_key
35. #HostKey /etc/ssh/ssh_host_dsa_key
36. # Lifetime and size of ephemeral version 1 server key
37. #KeyRegenerationInterval 1h
38. #ServerKeyBits 1024 #定义密钥长度，默认长度1024
39. # Logging
40. # obsoletes QuietMode and FascistLogging
41. #SyslogFacility AUTH
42. SyslogFacility AUTHPRIV
43. #LogLevel INFO
44. # Authentication:
45. #LoginGraceTime 2m #连接断开前等待时间
46. #PermitRootLogin yes #禁止root用户登陆
47. #StrictModes yes
48. #MaxAuthTries 6
49. #MaxSessions 10
50. #RSAAuthentication yes
51. #PubkeyAuthentication yes
52. #AuthorizedKeysFile .ssh/authorized_keys
53. #AuthorizedKeysCommand none
54. #AuthorizedKeysCommandRunAs nobody
55. # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
56. #RhostsRSAAuthentication no
57. # similar for protocol version 2
58. #HostbasedAuthentication no
59. # Change to yes if you don't trust ~/.ssh/known_hosts for
60. # RhostsRSAAuthentication and HostbasedAuthentication
61. #IgnoreUserKnownHosts no
62. # Don't read the user's ~/.rhosts and ~/.shosts files
63. #IgnoreRhosts yes
64. # To disable tunneled clear text passwords, change to no here!
65. #PasswordAuthentication yes
66. #PermitEmptyPasswords no
67. PasswordAuthentication yes #是否允许使用账号和密码登陆，改为no将不允许使用账号和密码登陆，可使用私钥登陆。
68. # Change to no to disable s/key passwords
69. #ChallengeResponseAuthentication yes
70. ChallengeResponseAuthentication no
71. # Kerberos options
72. #KerberosAuthentication no
73. #KerberosOrLocalPasswd yes
74. #KerberosTicketCleanup yes
75. #KerberosGetAFSToken no
76. #KerberosUseKuserok yes
77. # GSSAPI options
78. #GSSAPIAuthentication no
79. GSSAPIAuthentication yes
80. #GSSAPICleanupCredentials yes
81. GSSAPICleanupCredentials yes
82. #GSSAPIStrictAcceptorCheck yes
83. #GSSAPIKeyExchange no
84. # Set this to 'yes' to enable PAM authentication, account processing,
85. # and session processing. If this is enabled, PAM authentication will
86. # be allowed through the ChallengeResponseAuthentication and
87. # PasswordAuthentication. Depending on your PAM configuration,
88. # PAM authentication via ChallengeResponseAuthentication may bypass
89. # the setting of "PermitRootLogin without-password".
90. # If you just want the PAM account and session checks to run without
91. # PAM authentication, then enable this but set PasswordAuthentication
92. # and ChallengeResponseAuthentication to 'no'.
93. #UsePAM no
94. UsePAM yes
95. # Accept locale-related environment variables
96. AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
97. AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
98. AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
99. AcceptEnv XMODIFIERS
100. #AllowAgentForwarding yes
101. #AllowTcpForwarding yes
102. #GatewayPorts no
103. #X11Forwarding no
104. X11Forwarding yes
105. #X11DisplayOffset 10
106. #X11UseLocalhost yes
107. #PrintMotd yes #是否打印 /etc/motd 连接时显示的信息
108. #PrintLastLog yes #是否显示上次登陆信息
109. #TCPKeepAlive yes
110. #UseLogin no
111. #UsePrivilegeSeparation yes #是否允许低权限用户产生新连接进程，no表示如何用户都是用root权限运行ssh
112. #PermitUserEnvironment no
113. #Compression delayed
114. #ClientAliveInterval 0
115. #ClientAliveCountMax 3
116. #ShowPatchLevel no
117. #UseDNS yes #是否启用DNS验证，外网需要启用
118. #PidFile /var/run/sshd.pid #存放服务进程ID
119. #MaxStartups 10:30:100
120. #PermitTunnel no
121. #ChrootDirectory none
122. # no default banner path
123. #Banner none
124. # override default of no subsystems
125. Subsystem sftp /usr/libexec/openssh/sftp-server
126. # Example of overriding settings on a per-user basis
127. #Match User anoncvs
128. # X11Forwarding no
129. # AllowTcpForwarding no
130. # ForceCommand cvs server

 

 

来自为知笔记(Wiz)